Android/frameworks_base
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Check for null-terminator in ResStringPool::string8At

Browse Source 
All other stringAt methods check for null termination. Be consistent
so that upper levels don't end up with huge corrupt strings.

Bug: 62537081
Test: none
Change-Id: I17bdfb0c1e34507b66c6cad651bbdb12c5d4c417
(cherry picked from commit 3d35a0ea30)
(cherry picked from commit 97f8cb01149b35b1832c7f9efe85ff19edf1083e)
This commit is contained in:
Adam Lesinski
2017-11-09 17:12:17 -08:00
parent 6a9c7c4814
commit 5ec65ae909
1 changed files with 7 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
libs/androidfw/ResourceTypes.cpp
View File

@@ -785,6 +785,12 @@ const char* ResStringPool::string8At(size_t idx, size_t* outLen) const
*outLen = decodeLength(&str); *outLen = decodeLength(&str);
size_t encLen = decodeLength(&str); size_t encLen = decodeLength(&str);
if ((uint32_t)(str+encLen-strings) < mStringPoolSize) { if ((uint32_t)(str+encLen-strings) < mStringPoolSize) {
// Reject malformed (non null-terminated) strings
if (str[encLen] != 0x00) {
ALOGW("Bad string block: string #%d is not null-terminated",
(int)idx);
return NULL;
}
return (const char*)str; return (const char*)str;
} else { } else {
ALOGW("Bad string block: string #%d extends to %d, past end at %d\n", ALOGW("Bad string block: string #%d extends to %d, past end at %d\n",